Workspace
Where: Workspace in the sidebar (#/activity). The older crew canvas
is one click away via Crew view in the header (#/workspace).
The Workspace is a chat with the Coordinator. Ask it about your setup in plain language, or run a slash command. Every answer shows the records it came from, and the Coordinator can’t change anything: buttons in an answer only open a page or start something you would start yourself.
public/guide/workspace.pngAsk about your setup
Type a question and press Enter. Good first questions:
- Why am I bronze, and what would get me to silver?
- Why was my last proposal denied?
- Which of my rules are about production?
The Coordinator answers from a snapshot of your own records, taken when you ask:
- your Application and its services;
- the latest gap report and every scored row, with its status and evidence note;
- your recent proposals and the constitution’s verdict on each;
- the rules in force;
- your open findings.
What you see in an answer
- The answer: short, with the numbers quoted exactly as your gap report and the constitution recorded them. The Coordinator never computes a score or a verdict itself; to change a score, run a new gap analysis.
- Sources: one chip per record the answer relies on, for example Gap report: bronze, 23% or tests_in_ci: missing. Each chip opens that record. The label is written by TruStacks from the record itself, not by the model.
- Buttons, when they help: Run a gap analysis, Open the gap report, Open the proposal, Open the rule or Draft a rule. Each button opens a page or starts the same thing you would start yourself. Approving and merging stay with you.
- Not in your records: when your records don’t hold the answer, it says so instead of guessing. Those questions are kept so we can see what people need.
Follow-up questions continue the conversation (“and what about gold?”).
Answers run on your runner, with your LLM key, like every other agent run. Asking needs runner 0.2.15 or later. With an older runner, the chat says No connected runner can answer questions yet. Upgrade your runner… and links to Runners.
The commands
| Command | What it does |
|---|---|
/gaps | Runs a fresh gap analysis in the chat. The Constitution reports the gaps, the Coordinator consults Baseline Security and SOC2, and the run ends with a summary and View the full report →. /audit still works. |
/discover | Takes you to your services to connect a repo. |
/rule new <plain-English description> | Drafts an overlay rule from your description. The Coordinator proposes a rule id and writes the Rego. |
/rule new <rule_id> | Starts a draft with an id you choose; your next message is what the rule should deny. |
Drafting a rule
The draft arrives as a file block, rules/<rule_id>/<rule_id>.rego, with
Copy and Download, the Coordinator’s reasoning, and a reminder of the
CLI steps to land it.
public/guide/workspace-rule-draft.pngCheck what a draft would have blocked
Under every finished draft: Would it have blocked my recent proposals?
TruStacks replays your Application’s 10 most recent proposals through the policy engine twice: once with the rules you have today, and once with the draft added. You see, for each proposal:
- would be blocked, with the draft’s own message; or
- passes this rule;
- and, if the policy already refused it for another reason, (already refused by …).
The policy engine decides every line; the assistant isn’t involved. Use this before you land a rule:
- It blocks nothing you expected it to? The draft may not be looking where your changes are. In the walkthrough for this guide, a draft that treated “production deploy” as one particular deploy action blocked 0 of 10 proposals, because the service deploys a different way.
- It blocks everything? It may be too broad, or it may ask for something no proposal can provide.
The check refuses a draft that wouldn’t actually be enforced. For example, a
draft whose package isn’t overlay.<name> would load but never be consulted,
and it says so instead of reporting “blocks nothing”.
Proposals from runner 0.2.15 on record exactly what the policy check was told about their target, so a replay sees the same thing. Older proposals are replayed with your Application’s current target settings, and the result notes that.
A draft is not live. Nothing is saved to your repos and nothing is
enforced from the chat. On the hosted service there is no supported way yet
to deliver your own rules to your runner; loading them from your platform
repo is planned. Today a draft lands through
the trustacks rule CLI in a local environment; see the
policy authoring workshop.
Rule ids are <namespace>.<name>, lowercase with underscores, for example
acme.requires_runbook_link. TruStacks-reserved namespaces (argocd,
constitution, posture, practice, proposal, trustacks) are refused.
Keep the draft’s package overlay.<name> line as written: the runner refuses
an overlay with a package outside overlay..
Your conversation is kept for 24 hours
Leave the Workspace and come back, and the conversation is still there, including anything that finished while you were away. A question still being answered picks up where it was.
What is kept is a list of references to your questions, gap analyses and rule drafts, in your browser, per workspace and per user. The content is reloaded from TruStacks when you return. New conversation clears it.
Crew view
Crew view (header, top right) shows the newest analysis or proposal as a flow of the agents that took part: who delegated to whom, each event in the voice of the agent that produced it, and the most recent tool call with its full parameters. A specialist that wasn’t consulted isn’t drawn. Back to the chat returns here.
How it connects
- Answers and their sources → Gap analyses, Maturity, Applications and proposals, Rules
/gaps→ Gap analyses/rule new→ Rules and the policy authoring workshop
Beta limits
- Answers only know your records. The snapshot holds scores, verdicts, rules and findings, not file contents. A question about what is in a file gets Not in your records.
- The chat doesn’t pick an Application. With more than one Application,
answers speak to what is common to all of them, and
/gapsasks you to start the run from Gap analyses, where you choose. - Rule drafting is single-pass. You can’t refine a draft turn by turn yet, and the Coordinator doesn’t yet check that a rule is satisfiable or scope it to a tier. That is the next slice.
- The sidebar’s Crew online strip is a static roster, not live status.